SmoothBrowser
WarnAudited by ClawScan on May 10, 2026.
Overview
SmoothBrowser appears purpose-built for browser automation, but it grants broad delegated web and logged-in account control with persistent sessions and memory reuse that need careful review.
Install only if you are comfortable with a third-party browser automation agent handling web tasks. Use separate temporary profiles, URL allow-lists, and explicit confirmations for logged-in actions, form submissions, purchases, posts, deletions, or any task involving sensitive data.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could perform meaningful actions on websites, including submitting forms or acting inside logged-in accounts, without the artifacts defining approval gates for sensitive steps.
The skill delegates broad browser actions, including login and form workflows, to another intelligent agent and encourages high-level goals rather than step-by-step control.
Browser for AI agents to carry out any task on the web... Trigger phrases include "fill out the form", "scrape", "automate", "test the website", "log into"... Smooth is powered by an intelligent agent, DO NOT over-controll it
Use this only for clearly scoped tasks. Require confirmation before purchases, submissions, account changes, posting, deleting, or sharing data, and prefer URL allow-lists where possible.
A reused profile can carry the user's logged-in privileges into future browser automation tasks, including account mutations.
The skill stores and reuses authenticated browser state, then demonstrates using that state to take actions inside a user's account.
Profiles are useful to persist cookies, login sessions, and browser state between sessions... Reuse authenticated profile... smooth run -- <session-id> "Create a new issue in my repo 'my-project'"
Create separate profiles per site/account, avoid using highly sensitive accounts unless necessary, use read-only or temporary profiles when possible, and ask for explicit approval before reusing a logged-in profile.
Persistent memory could cause the agent to reuse a logged-in profile later, potentially against the wrong task or without the user realizing which account is active.
The skill asks the agent to persist knowledge about which browser profiles are authenticated to which services, enabling later reuse of those sessions.
Keep profiles organized: Save to memory which profiles authenticate to which services so you can reuse them efficiently in the future.
Only save profile mappings with user consent, review and delete stale profile memories, and require confirmation before using any remembered authenticated profile.
Selected files, personal details, or task context may be exposed to the browser automation workflow and possibly the Smooth provider.
The skill supports making files and task metadata available to a Smooth browser-agent session. This is purpose-aligned, but the artifact does not spell out detailed data boundaries.
--files - Comma-separated file IDs to make available in the session... --metadata - JSON object with variables for the task... Smooth is powered by an intelligent agent
Pass only the minimum files and metadata needed for the task, avoid secrets unless essential, and check Smooth's data handling policy before use.
Installing or updating the CLI runs third-party code outside this skill review.
The skill depends on an external CLI package that is not included in the reviewed artifacts. This is expected for this type of integration, but the package code and version are not reviewed here.
Assume the Smooth CLI is already installed. If not, you can install it by running: pip install smooth-py
Verify the smooth-py package source, version, and publisher before installing, and install it in a controlled environment when possible.